How to audit an Odoo instance in 2026
Is the database manager public?
Deeper than a manual audit or a tool. At the scale AI agents attack.
The audit starts after signup. $49 for one month. Your report stays in your account.
- Version
- Database manager
- XML-RPC
- Known CVEs
01 / 08·running
Public surface
Other hosts and open ports
Signals
- VersionThe Odoo release your login page and static files give away.
- Database managerThe manager, the selector, and a list of database names.
- XML-RPCThe common XML-RPC endpoint answering on the public host.
- Known CVEsPublished holes in that Odoo release.
How the Odoo audit runs
What else is on this domain
Other hostnames on the same domain, then the ports those servers leave open, before anything Odoo-specific.
Subdomains
Staging, old admin hosts, and the other names on your domain.
Live hosts
Which of those names actually answer.
Open ports
What is listening, including the version when the server says it.
On your Odoo
Odoo version, the database manager, the database list, and XML-RPC.
Version
The Odoo release your login page and static files give away.
Database manager
The manager, the selector, and a list of database names.
XML-RPC
The common XML-RPC endpoint answering on the public host.
Known CVEs
Published holes in that Odoo release.
A report you can act on
Each issue names the host, shows the evidence, and says what to fix. Anything we could not confirm stays marked that way.
Evidence
The URL or file that proved it.
CVE ids
Only when we saw the version the advisory is about.
Account
The report opens after the $49 month is paid.
Questions about a Odoo audit
What the run covers, and when the report opens in the account.
Contact usAudit Odoo from the outside.
Deeper than a manual audit or a tool. At the scale AI agents attack.